In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case). Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom. In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data. Fix this by dropping non IPv6 packets. A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100578 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

    The aoe driver (or similar) generates a non-IPv6 packet     (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit()     on a 6LoWPAN interface (configured by the user or test case).

    Since the packet is not IPv6, the 6LoWPAN header_ops->create function     (lowpan_header_create or header_create) returns early without initializing     the lowpan_addr_info structure in the skb headroom.

    In the transmit function (lowpan_xmit), the driver calls lowpan_header     (or setup_header) which unconditionally copies and uses the lowpan_addr_info     from the headroom, which contains uninitialized data.

    Fix this by dropping non IPv6 packets.

    A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a     non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN     interface (configured by the user or test case). Since the packet is not IPv6, the 6LoWPAN     header_ops->create function (lowpan_header_create or header_create) returns early without initializing the     lowpan_addr_info structure in the skb headroom. In the transmit function (lowpan_xmit), the driver calls     lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the     headroom, which contains uninitialized data. Fix this by dropping non IPv6 packets. A similar fix is     needed in net/bluetooth/6lowpan.c bt_xmit(). (CVE-2026-63870)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
336635	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100578)	Nessus	Unity Linux Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328260	Linux Distros Unpatched Vulnerability : CVE-2026-63870	Nessus	Misc.	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-63870

high

Tenable Plugins

high

high

high

high

high

high